Deployment Architecture

Search Head Session Files on Shared Storage


Search head pooling is great and all - what's bothering me is this: Why can I synchronize configurations between search heads, but not synchronize the session state? Right now my load balancer creates sticky sessions and sticks a user to a certain search head for the duration of their session. This causes a couple of problems: If this user is using heavier dashboards, it will degrade performance for other users. If a search head goes down and users are redistributed, these users won't drift back, meaning increased load and degraded user performance.

What I would like to do is share user session state across all search heads so I can get rid of the sticky requirement and load balance requests more evenly across the search heads. There's also added benefit of quickly standing up new search heads as load required. The user session files are kept locally for each search head in $SPLUNK_HOME/var/run/splunk. Is there any reason that this cannot be moved over to shared storage as well, letting the sessions be shared?

I'm guessing the most likely culprit to stopping this would be the session GC routines as most everything else in $SPLUNK_HOME/var/run/splunk was moved to $SHARED_STORAGE/var/run/splunk. I was just curious if anyone else knew of a more definitive answer.

Splunk Employee
Splunk Employee

It is not currently possible to share sessions across a pool. Work needs to be on splunkd's auth components and splunkweb's session files to support this feature.

Splunk Employee
Splunk Employee

Did anyone ever submit this as a feature request? Anyone know if this was ever added (I see this post is from 2011).

0 Karma
Get Updates on the Splunk Community!

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...